Top all-time · #6987
Randy Westergren
Personal blog · randywestergren.comsecurityprogramming
Randy Westergren's personal blog at randywestergren.com covers security and programming. Since 2014, 11 different Hacker News readers have linked it 53 times, most often “Reverse Engineering the Subway Android App”. It is still writing: the last post was on 2026-01-06, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Randy Westergren's reverse-engineering posts on mobile apps, such as his teardown of Subway's app and Paydiant's CurrentC, and on certificate pinning in Android apps.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Development, security research, and other adventures in code
Most-linked posts?
- Reverse Engineering the Subway Android App3 people · 3 mentions · first linked 2015-07-10
- Widespread XSS Vulnerabilities in Ad Network Code2 people · 3 mentions · first linked 2016-03-02
- Reverse Engineering the OBi200 Google Voice Appliance: Part 12 people · 2 mentions · first linked 2017-08-31
- Running a Hidden Tor Service with Docker Compose2 people · 2 mentions · first linked 2016-01-03
What Hacker News says?
> because the ringer requires a much higher voltage than can be generated by a small computer. I mean that’s not quite true. A magicjack which is basically an ATA is about the size of the Pi Zero and produces ring power. A REN is on the order of 10 mA which at 90V can be generated by a very small (like smaller than a dime) switcher. Indeed the quickest and easiest way to “modernize” an old phone is probably to stuff…
Comment linking /reverse-engineering-obi200-google-voice-appliance-part-2/
on “Show HN: Mum's 80th birthday present- a rotary phone from the 1970's”Submitted United Airlines Bug Bounty: An experience in reporting a serious vulnerability as a story · 164 points
HN discussionBack from 2015, bypassing an APK signature check: https://randywestergren.com/reverse-engineering-the-yik-yak-...
Comment linking /reverse-engineering-the-yik-yak-android-app/
on “APKTool: A tool for reverse engineering Android APK files”Submitted Widespread XSS Vulnerabilities in Ad Network Code as a story · 142 points
HN discussionInteresting to note that a number of these sites were recently also serving ads vulnerable to XSS: http://randywestergren.com/widespread-xss-vulnerabilities-ad...
Comment linking /widespread-xss-vulnerabilities-ad-network-code-affecting-top-tier-publishers-retailers/
on “Major sites including New York Times and BBC hit by 'ransomware' malvertising”Submitted Event-driven access to my home after a run as a story · 114 points
HN discussionI'm not sure if this had been mitigated in the standard, but the pinning implementations I've seen used in Android apps rely on client-side (i.e. app) verification. It's an inconvenience, for sure, for someone trying to emulate the app (in order to connect to the server API). But it's not sufficient to stop a determined attacker with a bytecode decompiler. For instance: http://randywestergren.com/reverse-engineering…
Comment linking /reverse-engineering-the-subway-android-app/
on “What You Need to Know about HTTP Public Key Pinning (HPKP)”Submitted Rave Panic Button: Vulnerabilities in a Nationwide Emergency Alert System as a story · 85 points
HN discussionI believe CurrentC's (Paydiant's) QR code tokenization works the same as you've described Apple Pay tokenization - the merchant POS does not see any payment info other than a one-time-use token. This was another decent teardown of Paydiant's Subway app - but it looks like someone high up has had some of the code redacted :) http://randywestergren.com/reverse-engineering-the-subway-an... Functionally, it looks like C…
Comment linking /reverse-engineering-the-subway-android-app/
on “Hands on with Apple Pay Competitor CurrentC”Submitted Critical Vulnerability in Verizon Mobile API Compromising User Email Accounts as a story · 78 points
HN discussionSubmitted A closer look at recent HTTP/2 vulnerabilities affecting Kubernetes and others as a story · 63 points
HN discussionSubmitted Cutting the Lights: Vulnerabilities in a Billboard Lighting System as a story · 45 points
HN discussionSubmitted Reverse Engineering the Subway Android App as a story · 39 points
HN discussionSubmitted Unauthenticated Remote Code Execution in Motorola Baby Monitors as a story · 12 points
HN discussionSubmitted How I Cracked Trivia Crack as a story · 9 points
HN discussionSubmitted Men's Wearhouse Perfect Fit App Vulnerability Exposing Customer Information as a story · 9 points
HN discussionSubmitted Reverse Engineering the Yik Yak Android App as a story · 8 points
HN discussionSubmitted Widespread XSS Vulnerabilities in Ad Code Affecting Top Tier Publishers as a story · 7 points
HN discussionSubmitted Why compliance, certs, and “security” seals aren't working as a story · 6 points
HN discussionSubmitted Fetching Vendor Data at Scale with Serverless as a story · 4 points
HN discussionSubmitted Critical Vulnerability Compromising Verizon Email Accounts (Again) as a story · 4 points
HN discussionSubmitted Compliance Strikes Again: Multiple Vulnerabilities in Worldpay’s Merchant Portal as a story · 4 points
HN discussionSubmitted Running a Hidden Tor Service with Docker Compose as a story · 4 points
HN discussionSubmitted Marriott vulnerability exposing hotel reservations and payment info [FIXED] as a story · 4 points
HN discussionSubmitted Hijacking Verizon FiOS Accounts [FIXED] as a story · 3 points
HN discussionSubmitted Attacking Real Estate Showings in ShowingTime as a story · 3 points
HN discussionSubmitted Analyzing VPC Flow Logs to Reduce Nat Gateway Costs as a story · 2 points
HN discussionSubmitted Building Pymssql (FreeTDS) for Lambda as a story · 2 points
HN discussionSubmitted Persistent XSS in PNC’s Secure Email System as a story · 2 points
HN discussionSubmitted Reverse Engineering the OBi200 Google Voice Appliance: Part 1 as a story · 2 points
HN discussion